CVE-2026-82060: Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups
In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can insert documents into a sharded collection can store specially crafted operator-shaped objects in shard key fields. The impact is triggered when change stream processing later performs a post-image lookup.
What configuration or workflow is required for impact?
The affected collection must be sharded, and a change stream must use the updateLookup full document mode. Without post-image lookups in that mode, the described vulnerable internal query path is not invoked.
What could an affected change stream consumer observe?
Consumers may receive an incorrect post-image document. Processing can also fail with a fatal error that is not resumable.